Re: [PATCH] x86/mm: Don't force unencrypted DMA for IOMMU-backed devices

[Aneesh Kumar K . V]

Tom Lendacky <thomas.lendacky@xxxxxxx> writes:

> On 9/8/26 06:32, Aneesh Kumar K.V (Arm) wrote:

 [ ... 39 lines skipped ... ] 

>>  
>> @@ -30,7 +31,7 @@ bool force_dma_unencrypted(struct device *dev)
>>  	 * device does not support DMA to addresses that include the
>>  	 * encryption mask.
>>  	 */
>> -	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT)) {
>> +	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT) && !use_dma_iommu(dev)) {
>
> When this support was originally added many years ago, this function was
> not called if an IOMMU was active and generating IOVAs. So if this
> function is now called even when an IOMMU is performing the DMA mapping,
> then this is appropriate. Although, it would seem that if an IOMMU is
> performing the mapping and this function is still being called, checking
> use_dma_iommu(dev) and exiting early from force_dma_unencrypted() at the
> very beginning is more appropriate, right?
>

I don't think that is correct for a confidential guest with a stage-1 IOMMU.


> @Alexey, would that impact your TIO/TDISP support at all?
>

-aneesh